CAN injection and the death of the immobilizer

Definition

CAN injection — a vehicle theft attack at the physical layer. An adversary splices into the car's CAN bus (typically at the headlight wiring connector), floods it with forged "smart key is valid" frames, and defeats the immobilizer. No fob, no radio relay, no key cloning.

CAN (Controller Area Network) — a broadcast bus linking a vehicle's ECUs. Any node may transmit; by default, no node authenticates any other. That design assumption is the vulnerability.

Attack chain

1. Recon. Trim tampering and pulled wiring are reconnaissance, not vandalism.
2. Access. Bumper off; splice onto CAN_H/CAN_L at the headlight connector. The wire, not the lamp.
3. Inject. Roughly $10 of parts: a Microchip PIC18F with CAN, a transceiver, and a dominant-override circuit. On "emergency start" dark-web sites the finished gadget ships disguised as a JBL Bluetooth speaker at ~€5,000.
4. Flood. After a wake-up frame, the device transmits spoofed key-valid frames ~20×/second while driving the bus recessive, forcing genuine ECUs into bus-off.
5. Relay. The gateway forwards the fake key-valid message to the powertrain bus. Immobilizer dead. The device's Play button unlocks the doors.

CCTV captured a 2021 RAV4 stolen in under two minutes (Ars Technica).

Provenance. Ian Tabor (EDAG) lost a Toyota RAV4 in late July 2022 after two prior break-ins. Telematics DTCs showed comms lost not just to the headlight ECU but to the front cameras and hybrid-engine control — a shared bus, not part failures. Ken Tindell (Canis Automotive Labs) reverse-engineered the gadget; his write-up appeared 3 Apr 2023, and the attack holds CVE-2023-29389 (Tindell).

Why your fob is irrelevant

CAN injection bypasses the keyless-entry radio path entirely. Faraday pouches, motion-sleep keys, fob firmware updates: zero effect. Your threat model is a pair of wires in the wheel arch.

Scale (UK epicentre)

Do not conflate: the Kia/Hyundai US theft wave is a separate bug class (missing immobilizer), not CAN injection.

Law and vendor response

The Crime and Policing Act 2026, s.149 criminalises possessing, importing, making, or supplying electronic theft devices — explicitly including "devices used to access a vehicle's wiring system" — at up to five years and an unlimited fine, with a reverse burden of proof. Toyota GB responded in detail only in April 2024, after a BBC Watchdog investigation. JLR reports theft down >50% since Nov 2022; Toyota's tracker trial hit ~95% recovery.

Mitigations: owner checklist

• Steering-wheel lock. Dumb, visible, shifts the attacker's time budget.
• Thatcham-approved tracker (£250–£800).
• PIN-code aftermarket immobiliser.
• Park to block headlight access — nose-in, against a wall or barrier.
• Treat trim tampering as recon. If your car reports DTCs to an app, read them.

Failure modes: locks yield to bolt cutters; trackers can be found and removed; PIN immobilisers add friction, not guarantees. These controls raise attacker cost. They do not zero it.

Mitigations: OEM

• Software fix (Tindell): gateways refuse key-valid messages after CAN bit errors. Cheap, firmware-deployable — and bypassable.
• Durable fix: authenticated CAN — AUTOSAR SecOC or Canis CryptoCAN over a SHE-standard HSM. Emulatable in ~3KB of code and 200B of RAM; deployable by firmware update.
• Anti-pattern: dominant-override transceivers defeat anti-spoofing hardware such as NXP's Stinger. Hardware-only answers lose. Crypto is the only robust control.

Grudging upside

Opinion: CAN injection is the cleanest public demonstration that a control plane which authenticates nothing ends up owned by whoever touches the wire. Cars shipped an unauthenticated broadcast bus for decades; the fix is known, small, and OTA-shippable. The gap between "known" and "deployed" is the real vulnerability. Watch it close — or don't.

Sources

• CAN Injection: keyless car theft — Ken Tindell
• There's a new form of keyless car theft that works in under 2 minutes — Ars Technica
• Organised Vehicle Theft in the UK: Trends and Challenges — RUSI, June 2025
• 97% of vehicles recovered in 2024 stolen without the key fob — Tracker Network UK